rule MAL_ELF_RotaJakiro_May_2021_1 {
   meta:
        description = "Detect the ELF version of RotaJakiro"
        author = "Arkbird_SOLG"
        reference = "https://blog.netlab.360.com/rotajakiro_linux_version_of_oceanlotus/"
        date = "2020-05-07"
        hash1 = "0958e1f4c3d14e4de380bda4c5648ab4fa4459ef8f5daaf32bb5f3420217af32"
        hash2 = "5d753e72ef89f1cef3b7007df812c7a504727816a7b91ecd75cc9acdfb7e9c2e"
        hash3 = "a18bec90b2b6185362eeb67c516c82dd34cd8f6a7423875921572e97ae1668b0"
        hash4 = "af2a2be20d7bbec0a9bb4a4dfa898aa18ef4994a9791d7cf37b7b62b379992ac"
        hash5 = "d38e8f113c36cfa9e05c4d0d6b526d81b69039430c3b1fc64a08a3445b5a5abe"
        tlp = "White"
        adversary = "Oceanlotus"
   strings:
        $seq1 = { 41 57 41 56 41 55 41 54 41 89 f5 55 53 49 89 fc 48 83 ec 58 64 48 8b 04 25 28 00 00 00 48 89 44 24 48 31 c0 e8 77 60 ff ff 89 c7 e8 20 60 ff ff 48 8b 58 20 c6 44 24 10 85 48 8d 7c 24 10 c6 44 24 11 2d c6 44 24 12 c5 ba 22 00 00 00 c6 44 24 13 7a c6 44 24 14 02 be 30 00 00 00 c6 44 24 15 58 c6 44 24 16 30 c6 44 24 17 e4 c6 44 24 18 8a c6 44 24 19 37 c6 44 24 1a bd c6 44 24 1b 68 c6 44 24 1c f6 c6 44 24 1d f8 c6 44 24 1e 6c c6 44 24 1f 8c c6 44 24 20 97 c6 44 24 21 cb c6 44 24 22 73 c6 44 24 23 bd c6 44 24 24 7b c6 44 24 25 19 c6 44 24 26 93 c6 44 24 27 a0 c6 44 24 28 26 c6 44 24 29 26 c6 44 24 2a ae c6 44 24 2b 1c c6 44 24 2c 96 c6 44 24 2d 1d c6 44 24 2e 0f c6 44 24 2f be 44 8b 05 b6 7c 21 00 48 8b 0d b7 7c 21 00 c6 44 24 30 b2 c6 44 24 31 7d c6 44 24 32 48 c6 44 24 33 b9 c6 44 24 34 b6 c6 44 24 35 a4 c6 44 24 36 30 c6 44 24 37 43 c6 44 24 38 06 c6 44 24 39 e3 c6 44 24 3a 4f c6 44 24 3b 06 c6 44 24 3c f5 c6 44 24 3d 87 c6 44 24 3e d5 c6 44 24 3f 6a e8 3a 71 ff ff 48 89 df 48 89 c6 48 89 c5 e8 bc 6c ff ff 45 85 ed 48 89 c3 0f 85 a0 00 00 00 48 89 df e8 58 6e ff ff 85 c0 0f 84 30 01 00 00 8b 05 2a 7c 21 00 48 c7 44 24 08 00 00 00 00 48 83 ec 08 c7 44 24 0c 00 00 00 00 4c 8b 0d 16 7c 21 00 ba 2a 00 00 00 4c 89 e6 bf 01 00 00 00 50 4c 8d 44 24 14 48 8d 4c 24 18 e8 b1 71 ff ff 85 c0 5a }
        $seq2 = { 41 54 41 b8 08 00 00 00 55 53 b9 00 f3 61 00 ba 42 00 00 00 49 89 fd 49 89 f4 48 83 ec 68 be 50 00 00 00 48 89 e7 c6 04 24 bf c6 44 24 01 cf 64 48 8b 04 25 28 00 00 00 48 89 44 24 58 31 c0 c6 44 24 02 c6 c6 44 24 03 a1 c6 44 24 04 20 c6 44 24 05 76 c6 44 24 06 5d c6 44 24 07 e5 c6 44 24 08 ec c6 44 24 09 87 c6 44 24 0a 45 c6 44 24 0b 26 c6 44 24 0c e1 c6 44 24 0d c8 c6 44 24 0e 8e c6 44 24 0f c0 c6 44 24 10 89 c6 44 24 11 d2 c6 44 24 12 ac c6 44 24 13 c1 c6 44 24 14 01 c6 44 24 15 08 c6 44 24 16 ac c6 44 24 17 8e c6 44 24 18 52 c6 44 24 19 65 c6 44 24 1a c9 c6 44 24 1b 06 c6 44 24 1c be c6 44 24 1d 82 c6 44 24 1e ef c6 44 24 1f 85 c6 44 24 20 9f c6 44 24 21 96 c6 44 24 22 fa c6 44 24 23 65 c6 44 24 24 50 c6 44 24 25 dd c6 44 24 26 0e c6 44 24 27 e0 c6 44 24 28 87 c6 44 24 29 ba c6 44 24 2a 27 c6 44 24 2b f8 c6 44 24 2c ef c6 44 24 2d 5c c6 44 24 2e 60 c6 44 24 2f 07 c6 44 24 30 b1 c6 44 24 31 c5 c6 44 24 32 3d c6 44 24 33 81 c6 44 24 34 df c6 44 24 35 87 c6 44 24 36 64 c6 44 24 37 01 c6 44 24 38 04 c6 44 24 39 9b c6 44 24 3a f9 c6 44 24 3b da c6 44 24 3c 28 c6 44 24 3d f1 c6 44 24 3e 30 c6 44 24 3f cb c6 44 24 40 c8 c6 44 24 41 48 c6 44 24 42 43 c6 44 24 43 e6 c6 44 24 44 e5 c6 44 24 45 f3 c6 44 24 46 c9 c6 44 24 47 8b c6 44 24 48 3c c6 44 24 49 a7 c6 44 24 4a 8b c6 44 24 4b 48 c6 44 24 4c 54 c6 44 24 4d 13 c6 44 24 4e 2b c6 44 24 4f bb e8 a4 aa ff ff bf 00 04 00 00 48 89 c5 e8 77 9a ff ff be 00 04 00 00 48 89 c3 48 89 c7 e8 37 9b ff ff 4c 89 ea 48 }
        $seq3 = { 48 8d 7c 24 10 c6 44 24 10 fb c6 44 24 11 d0 64 48 8b 04 25 28 00 00 00 48 89 84 24 08 01 00 00 31 c0 c6 44 24 12 8d c6 44 24 13 ac c6 44 24 14 db c6 44 24 15 79 c6 44 24 16 84 c6 44 24 17 52 c6 44 24 18 44 c6 44 24 19 46 c6 44 24 1a 6c c6 44 24 1b d1 c6 44 24 1c ac c6 44 24 1d 31 c6 44 24 1e ca c6 44 24 1f 18 c6 44 24 20 18 c6 44 24 21 90 c6 44 24 22 ec c6 44 24 23 8f c6 44 24 24 a1 c6 44 24 25 74 c6 44 24 26 a8 c6 44 24 27 9a c6 44 24 28 53 c6 44 24 29 d4 c6 44 24 2a a4 c6 44 24 2b 5b c6 44 24 2c 68 c6 44 24 2d c8 c6 44 24 2e dd c6 44 24 2f a5 e8 18 a9 ff ff 48 89 c7 49 89 c5 e8 4d a6 ff ff 83 f8 01 74 40 31 db 4d 85 ed 74 08 4c 89 ef e8 b9 95 ff ff 48 8b 8c 24 08 01 00 00 64 48 33 }
        $seq4 = { ba 15 00 00 00 be 20 00 00 00 c6 44 24 30 b1 c6 44 24 31 be c6 44 24 32 54 c6 44 24 33 93 c6 44 24 34 29 c6 44 24 35 67 c6 44 24 36 1f c6 44 24 37 b5 c6 44 24 38 a5 c6 44 24 39 ec c6 44 24 3a 18 c6 44 24 3b 53 c6 44 24 3c f0 c6 44 24 3d f1 c6 44 24 3e fe c6 44 24 3f 9f c6 44 24 40 27 c6 44 24 41 8f c6 44 24 42 8d c6 44 24 43 77 c6 44 24 44 1e c6 44 24 45 e1 c6 44 24 46 e1 c6 44 24 47 f0 c6 44 24 48 9e c6 44 24 49 e2 c6 44 24 4a 0d c6 44 24 4b 96 c6 44 24 4c ff c6 44 24 4d 6c c6 44 24 4e b4 c6 44 24 4f 16 e8 09 a8 ff ff 4c 89 ef 48 89 c6 49 89 c4 e8 8b a3 ff ff 48 8d bc 24 90 00 00 00 41 b8 08 00 00 00 b9 00 f3 61 00 ba 69 00 00 00 be 70 00 00 00 48 89 04 24 c6 84 24 90 00 00 00 b3 c6 84 24 91 00 00 00 0b c6 84 24 92 00 00 00 18 c6 84 24 93 00 00 00 fd c6 84 24 94 00 00 00 71 c6 84 24 95 00 00 00 3b c6 84 24 96 00 00 00 b7 c6 84 24 97 00 00 00 fc c6 84 24 98 00 00 00 70 c6 84 24 99 00 00 00 18 c6 84 24 9a 00 00 00 f7 c6 84 24 9b 00 00 00 22 c6 84 24 9c 00 00 00 2d c6 84 24 9d 00 00 00 75 c6 84 24 9e 00 00 00 5d c6 84 24 9f 00 00 00 8f c6 84 24 a0 00 00 00 75 c6 84 24 a1 00 00 00 60 c6 84 24 a2 00 00 00 91 c6 84 24 a3 00 00 00 b3 c6 84 24 a4 00 00 00 1a c6 84 24 a5 00 00 00 0b c6 84 24 a6 00 00 00 00 c6 84 24 a7 00 00 00 5c c6 84 24 a8 00 00 00 6b c6 84 24 a9 00 00 00 8d c6 84 24 aa 00 00 00 ee c6 84 24 ab 00 00 00 3b c6 84 24 ac 00 00 00 7e c6 84 24 ad 00 00 00 67 c6 84 24 ae 00 00 00 72 c6 84 24 af 00 00 00 43 c6 84 24 b0 00 00 00 f6 c6 84 24 b1 00 00 00 14 c6 84 24 b2 00 00 00 32 c6 84 24 b3 00 00 00 c1 c6 84 24 b4 00 00 00 79 c6 84 24 b5 00 00 00 0d c6 84 24 b6 00 00 00 0d c6 84 24 b7 00 00 00 22 c6 84 24 b8 00 00 00 e1 c6 84 24 b9 00 00 00 bd c6 84 24 ba 00 00 00 3f c6 84 24 bb 00 00 00 82 c6 84 24 bc 00 00 00 dd c6 84 24 bd 00 00 00 23 c6 84 24 be 00 00 00 7d c6 84 24 bf 00 00 00 87 c6 84 24 c0 00 00 00 34 c6 84 24 c1 00 00 00 9d c6 84 24 c2 00 00 00 43 c6 84 24 c3 00 00 00 98 c6 84 24 c4 00 00 00 da c6 84 24 c5 00 00 00 e0 c6 84 24 c6 00 00 00 3d c6 84 24 c7 00 00 00 64 c6 84 24 c8 00 00 00 1a c6 84 24 c9 00 00 00 d7 c6 84 24 ca 00 00 00 f5 c6 84 24 cb 00 00 00 5a c6 84 24 cc 00 00 00 c3 c6 84 24 cd 00 00 00 9c c6 84 24 ce 00 00 00 97 c6 84 24 cf 00 00 00 c7 c6 84 24 d0 00 00 00 65 c6 84 24 d1 00 00 00 8f c6 84 24 d2 00 00 00 99 c6 84 24 d3 00 00 00 eb c6 84 24 d4 00 00 00 2f c6 84 24 d5 00 00 00 2b c6 84 24 d6 00 00 00 d0 c6 84 24 d7 00 00 00 d9 c6 84 24 d8 00 00 00 4e c6 84 24 d9 00 00 00 8f c6 84 24 da 00 00 00 7b c6 84 24 db 00 00 00 97 c6 84 24 dc 00 00 00 3b c6 84 24 dd 00 00 00 14 c6 84 24 de 00 00 00 e9 c6 84 24 df 00 00 00 e9 c6 84 24 e0 00 00 00 82 c6 84 24 e1 00 00 00 48 c6 84 24 e2 00 00 00 dc c6 84 24 e3 00 00 00 a3 c6 84 24 e4 00 00 00 75 c6 84 24 e5 00 00 00 ca c6 84 24 e6 00 00 00 e6 c6 84 24 e7 00 00 00 40 c6 84 24 e8 00 00 00 6b c6 84 24 e9 00 00 00 b1 c6 84 24 ea 00 00 00 68 c6 84 24 eb 00 00 00 42 c6 84 24 ec 00 00 00 56 c6 84 24 ed 00 00 00 b4 c6 84 24 ee 00 00 00 ac c6 84 24 ef 00 00 00 2a c6 84 24 f0 00 00 00 fc c6 84 24 f1 00 00 00 34 c6 84 24 f2 00 00 00 fa c6 84 24 f3 00 00 00 1d c6 84 24 f4 00 00 00 1b c6 84 24 f5 00 00 00 9a c6 84 24 f6 00 00 00 62 c6 84 24 f7 00 00 00 b3 c6 84 24 f8 00 00 00 39 c6 84 24 f9 00 00 00 6a c6 84 24 fa 00 00 00 19 c6 84 24 fb 00 00 00 1b c6 84 24 fc 00 00 00 f3 c6 84 24 fd 00 00 00 c5 c6 84 24 fe 00 00 00 d2 c6 84 24 ff 00 00 00 6a e8 55 a4 ff ff 48 89 c7 48 89 c5 e8 4a 92 ff ff 44 8d 7c 03 0a 4d 63 ff 4c 89 ff e8 1a 94 ff ff 4c 89 fe 48 89 c3 48 89 c7 e8 dc 94 ff ff 4c 89 f2 48 89 ee 48 89 df 31 c0 e8 2c 95 ff ff 48 89 da 8b 0a 48 83 c2 04 8d 81 ff fe fe fe f7 d1 21 c8 25 80 80 80 80 74 e9 89 c1 4c 8b 3c 24 48 89 de c1 e9 10 a9 80 80 00 00 0f 44 c1 48 8d 4a 02 4c 89 ff 48 0f 44 d1 89 c1 00 c1 48 83 da 03 48 29 da e8 93 a8 ff ff 4c 89 ff be ed 01 00 00 4c 89 3c 24 e8 d2 aa ff ff 48 8d 44 24 50 41 b8 08 00 00 00 b9 00 f3 61 00 ba 34 00 00 00 be 40 00 00 00 c6 44 24 50 c6 48 89 c7 c6 44 24 51 3b c6 44 24 52 16 c6 44 24 53 01 c6 44 24 54 92 c6 44 24 55 36 c6 44 24 56 81 c6 44 24 57 c8 c6 44 24 58 f3 c6 44 24 59 49 c6 44 24 5a a8 c6 44 24 5b 02 c6 44 24 5c 6f c6 44 24 5d 9d c6 44 24 5e db c6 44 24 5f 61 c6 44 24 60 8a c6 44 24 61 e3 c6 44 24 62 f4 c6 44 24 63 1b c6 44 24 64 33 c6 44 24 65 4d c6 44 24 66 b4 c6 44 24 67 00 c6 44 24 68 f4 c6 44 24 69 76 c6 44 24 6a 70 c6 44 24 6b 56 c6 44 24 6c e2 c6 44 24 6d f3 c6 44 24 6e 5c c6 44 24 6f 73 c6 44 24 70 06 c6 44 24 71 de c6 44 24 72 c5 c6 44 24 73 fa c6 44 24 74 4c c6 44 24 75 7b c6 44 24 76 34 c6 44 24 77 b9 c6 44 24 78 d3 c6 44 24 79 a6 c6 44 24 7a 9b c6 44 24 7b 03 c6 44 24 7c f7 c6 44 24 7d 8e c6 44 24 7e 37 c6 44 24 7f 6a c6 84 24 80 00 00 00 3a c6 84 24 81 00 00 00 97 c6 84 24 82 00 00 00 57 c6 84 24 83 00 00 00 25 c6 84 24 84 00 00 00 2c c6 84 24 85 00 00 00 ac c6 84 24 86 00 00 00 a6 c6 84 24 87 00 00 00 de c6 84 24 88 00 00 00 29 c6 84 24 89 00 00 00 ca c6 84 24 8a 00 00 00 c0 c6 84 24 8b 00 00 00 93 c6 84 24 8c 00 00 00 67 c6 84 24 8d 00 00 00 47 c6 84 24 8e 00 00 00 8d c6 84 24 8f 00 00 00 }
   condition:
        uint32(0) == 0x464c457f and filesize > 10KB and 3 of ($seq*) 
}
